CVE-2026-97328

The WebP Express WordPress plugin, in versions prior to 0.25.16 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape values re-emitted by the plugin's bundled HTML parser into element attributes when a non-default image delivery mode is active. This allows ...